Appl. No: 09/759,089 

Amdt. Dated June 9, 2005 

Reply to Office action mailed: April 12, 2005 

Amendments to the Claims: 

This listing of claims will replace all prior versions and listings of claims in the 
application: 

Listing of Claims: 

1. (Currently Amended) In a computer network, a method for maintaining an 
acceptable use policy comprising: 

monitoring transport l ay e r TCP/IP network communications, wherein each 
network communication comprises multiple half sessions; 

storing at least some of said half sessions on disk, even when the 
communication does not conform to a known protocol; 

testing the stored communication for the presence of at least one pr e s ele ct e d 
criterion , wherein the preselected criterion is defined by a user ; 

deleting the communication if the presence of said at least one preselected 
criterion is not determined; and 

storing the communication if the presence of said at least one preselected 
criterion is determined. 

2. (Previously Presented) The method of claim 1, wherein the preselected 
criterion comprises one or more subject matter categories. 

3. (Previously Presented) The method of claim 2, wherein at least some of said 
subject matter categories comprise regular expressions. 

4. (Previously Presented) The method of claim 3, wherein said regular 
expressions are weighted. 

5. (Canceled). 
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6. (Previously Presented) The method of claim 2, wherein the preselected 
criterion is weighted. 

/.(Previously Presented) The method of claim 4, wherein said regular 
expressions are weighted with either positive or negative values. 

8. (Previously Presented) The method of claim 7, wherein regular expressions 
within a subject matter category having a negative value are before regular 
expressions having a positive value. 

9. (Previously Presented) The method of claim 4, further comprising prioritizing 
the order in which regular expressions within a subject matter category are tested. 

10. (Previously Presented) The method of claim 9, wherein said prioritizing 
reduces the likelihood of false hits. 

H.(Cancelled). 

12. (Previously Presented) The method of claim 1, wherein the computer 
network is a wide area network. 

13. (Previously Presented) The method of claim 1, wherein the computer 
network is a local area network. 

14. (Previously Presented) The method of claim 2, wherein the presence of the 
preselected criterion in at least one of said categories comprises a match in a plurality 
of categories. 

15. (Previously Presented) The method of claim 2, wherein said subject matter 
categories comprise key words. 

16. (Cancelled). 
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17. (Previously Presented) The method of claim 2, further comprising assigning 
a threshold value to each subject matter category. 

18. (Previously Presented) The method of claim 17, wherein at least some of 
said subject matter categories comprise one or more predetermined expressions. 

19. (Previously Presented) The method of claim 18, further comprising assigning 
a value to said predetermined expressions. 

20. (Previously Presented) The method of claim 19, further comprising summing 
the values of said predetermined expressions. 

21. (Previously Presented) The method of claim 20, wherein said 
communication is further stored if the sum of the values of said predetermined 
expressions comprising a subject matter category equal or exceed the threshold value 
assigned to said subject matter category. 

22. (Previously Presented) The method of claim 21, wherein the threshold value 
of at least one subject matter category comprises equaling or exceeding the threshold 
value in a plurality of subject matter categories. 

23. (Previously Presented) The method of claim 21, wherein said threshold 
values assigned to said subject matter categories are variable. 

24. (Previously Presented) The method of claim 18, wherein said subject matter 
categories have a hierarchical relationship. 

25. (Previously Presented) The method of claim 24, wherein said hierarchical 
relationship comprises defining the threshold value for at least one subject matter 
category as the presence of predetermined expressions in a plurality of other subject 
matter categories. 
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26. (Previously Presented) The method of claim 24, wherein said hierarchical 
relationship comprises defining the threshold value for at least one subject matter 
category as matching or exceeding the threshold value assigned to a plurality of other 
subject matter categories. 

27. (Previously Presented) The method of claim 1, further comprising outputting 
a report relating to the presence of said at least one preselected criterion. 

28. (Previously Presented) The method of claim 27, wherein said report 
identifies individuals whose use of the computer network included communications 
which matched preselected criterion. 

29. (Previously Presented) The method of claim 27, wherein said report 
identifies network addresses where communications were received or originated that 
included matched preselected criterion. 

30. (Previously Presented) The method of claim 2, further comprising outputting 
a report relating to the presence of preselected criterion, wherein said report identifies 
the number of matches in a category. 

31. (Previously Presented) The method of claim 30, wherein said report is in a 
graphical format. 

32. (Previously Presented) The method of claim 27, wherein said report 
provides the text of all communications that match said preselected criterion. 

33. (Previously Presented) The method of claim 27, wherein said report is in a 
human readable format. 

34. (Currently Amended) A method for monitoring and maintaining an 
acceptable use policy for computer network usage comprising: 
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capturing data on a network, wherein the data comprises multiple half sessions 
of transport l ay e r TCP/IP network communications; 

removing data content that does not contain language elements; 

testing the remaining content for the presence of predetermined expressions A 
wherein the predetermined expressions comprise two or more categories each 
containing predetermined expressions that are defined by a user ; 

maintaining a sum of values associated with said predetermined expressions 
found within at least one category; and 

storing the remaining data if the sum of values associated with said 
predetermined expressions within a category meets or exceeds a threshold value. 

35. (Previously Presented) The method of claim 34, wherein said computer 
network is a wide area network. 

36. (Previously Presented) The method of claim 34, wherein said computer 
network is a local area network. 

37. (Cancelled). 

38. (Previously Presented) The method of claim 34, wherein said expressions 
are weighted. 

39. (Previously Presented) The method of claim 38, wherein said expressions 
are weighted with either positive or negative values. 

40. (Previously Presented) The method of claim 39, further comprising 
prioritizing the order in which regular expressions within a subject matter category are 
tested. 

41. (Previously Presented) The method of claim 40, wherein the negative valued 
regular expressions are tested first. 
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42. (Previously Presented) The method of claim 41, wherein said negative and 
positive valued regular expressions are separately tested in the order of largest value 
to smallest value. 

43. (Previously Presented) The method of claim 40, wherein the order of said 
prioritizing is determined based upon reducing the likelihood of false hits. 

44. (Previously Presented) The method of claim 34, wherein said expressions 
include regular expressions. 

45. (Previously Presented) The method of claim 34, wherein the threshold value 
for at least one category comprises meeting or exceeding the threshold value for a 
plurality of other categories. 

46. (Previously Presented) The method of claim 34, wherein the threshold value 
of at least one category comprises meeting or exceeding the threshold value for at 
least one other category and not meeting or exceeding the threshold value for at least 
another category. 

47. (Previously Presented) The method of claim 35, wherein said threshold 
value for a category is variable. 

48. (Previously Presented) The method of claim 34, further comprising 
outputting a report relating to the presence of predetermined expressions. 

49. (Previously Presented) The method of claim 48, wherein said report 
identifies individuals whose use of the computer network included communications 
which matched predetermined expressions. 

50. (Previously Presented) The method of claim 48, wherein said report 
identifies network addresses where communications were received or originated that 

included matched predetermined expressions. 
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51. (Previously Presented) The method of claim 34, further comprising 
outputting a report relating to the presence of predetermined expressions, wherein 
said report identifies the number of matches in a category. 

52. (Previously Presented) The method of claim 50, wherein said report is in a 
graphical format. 

53. (Previously Presented) The method of claim 48, wherein said report 
provides the text of all communications that match said predetermined expressions. 

54. (Previously Presented) The method of claim 48, wherein said report is in a 
human readable format. 

55. (Currently Amended) A method for monitoring and maintaining an 
acceptable use policy for computer network usage comprising: 

capturing TCP/IP data on a network; 

removing data content that does not contain language elements; 

defining categories with weighted predetermined expressions , wherein the 
predetermined expressions are defined by a user ; 

testing the remaining content for the presence of predetermined expressions; 

maintaining a sum of values associated with said predetermined expressions 
found within each category; and 

storing the remaining data if the sum of values associated with said 
predetermined expressions present within a category exceeds a threshold value. 

56. (Previously Presented) The method of claim 55, wherein said remaining data 
is stored only if the sum of predetermined expressions exceeds the threshold value in 
a plurality of categories. 

57. (Previously Presented) The method of claim 55, wherein the threshold value 
for a category is defined as the presence of no predetermined expressions. 
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58. (Previously Presented) The method of claim 55, wherein said computer 
network is a wide area network. 

59. (Previously Presented) The method of claim 55, wherein said computer 
network is a local area network. 

60. (Cancelled). 

61. (Previously Presented) The method of claim 55, further comprising 
outputting a report relating to the presence of predetermined expressions whose sum 
meets or exceeds the threshold value of a category. 

62. (Previously Presented) The method of claim 61, wherein said report 
identifies individuals whose use of the computer network included communications 
which contained predetermined expressions whose sum matched or exceeded the 
threshold value of at least one category. 

63. (Previously presented) The method of claim 61, wherein said report 
identifies network addresses where communications were received or originated that 
included predetermined expressions whose sum matched or exceeded the threshold 
value of at least one category. 

64. (Previously Presented) The method of claim 63, wherein said report is in a 
graphical format. 

65 (New). The method of claim 1 wherein at least one stored half session 
comprises a plurality of independent parts, and the testing is performed individually on 
each independent part. 

66(New). The method of claim 65 wherein the independent parts comprise 
individual email messages. 
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67(New). The method of claim 65 wherein the independent parts comprise 
message attachments. 

68 (New). The method of claim 1 further comprising: 
prior to testing, attempting to identify a protocol by comparing the stored half 
session with known protocol patterns. 
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